JP2005182640A - Firewall apparatus, communication system using the same, and communication method - Google Patents

Abstract

[PROBLEMS] To independently perform basic operations without depending on the state of an OS or a terminal, and further to rewrite control data etc. without control by a terminal by clearly separating a firewall function and a remote control function. Can be executed independently.
The firewall device 1 is configured by hardware, analyzes a received packet, determines whether or not the packet includes remote control data, and includes the remote control data. Is a firewall core that stores the remote control data and, if the remote control data is not included, controls to determine whether the packet meets the passage condition based on the control data Part 12.
[Selection] Figure 1

Description

  The present invention relates to, for example, a firewall apparatus having a function of filtering illegal packets, a communication system using the same, and a communication method.

Conventionally, a firewall device is provided at the boundary between the inside of a network system (such as a LAN) and the outside (such as the Internet), and access from the outside is restricted by the firewall device, thereby improving the safety of the internal system. ing. Such a firewall device can monitor, for example, packets coming in from the Internet and packets going out from the LAN, and discard illegal packets as appropriate, but cannot control communications performed inside the LAN. Thus, today, software firewalls called personal firewalls are implemented for each terminal. While a normal firewall is installed and used at the boundary between the Internet and the LAN, this personal firewall is software that is installed for each terminal in combination with virus scanning software and executed on the OS. (Refer nonpatent literature 1).
NETWORK MAGAZINE January 2004 issue, P176-177, publisher ASCII, published November 22, 2003

  However, since the personal firewall is software installed for each terminal and executed on the OS as described above, the personal firewall largely depends on the OS and is not executed when the terminal is not activated. That is, in the personal firewall, even if the traffic is in a dangerous state, various functions such as filtering cannot be performed unless the terminal is activated.

  An object of the present invention is to configure a firewall device by hardware so that basic operations such as filtering can be performed independently without depending on the OS and without depending on the state of the terminal. Furthermore, the firewall function and the remote control function are clearly separated so that rewriting of control data or the like can be performed independently without control by the terminal.

  In order to achieve the above object, in the first aspect of the present invention, communication means for communicating with the outside via a network, remote control data storage means for storing at least remote control data, and reception by the communication means Analyzing the packet, determining whether the remote control data is included in the packet, and storing the remote control data in the remote control data storage means if the remote control data is included There is provided a firewall apparatus characterized by comprising firewall means for controlling.

  In the second aspect of the present invention, communication means for communicating with the outside via a network, remote control data storage means for storing at least remote control data, control data storage means for storing at least control data, and the communication means The packet received at is analyzed to determine whether the remote control data is included in the packet. If the remote control data is included, the remote control data is stored in the remote control data storage means. When the remote control data is not included, control is performed so as to determine whether or not the packet matches the passage condition based on the control data stored in the control data storage means. There is provided a firewall device comprising a firewall means.

  In the third aspect of the present invention, in the second aspect, when the firewall means determines that the packet matches the passage condition, the firewall means passes the packet and does not match the passage condition. A firewall device further characterized in that when judged, the packet is controlled to be discarded.

  According to a fourth aspect of the present invention, in the second aspect, log data storage means for storing the log data of the packet is further provided, and the firewall means meets the log condition included in the control data. There is provided a firewall device further characterized by determining whether or not the log data is satisfied and writing the log data of the packet in the log data storage means when the log condition is met.

  In a fifth aspect of the present invention, a first communication means for communicating with the outside via a network, a second communication means for communicating with a terminal, and a remote control data storage means for storing at least remote control data Analyzing at least the control data storage means for storing the control data and the packet received by the first communication means or the second communication means, and determining whether the remote control data is included in the packet. When the remote control data is included, the remote control data is stored in the remote control data storage means. When the remote control data is not included, the remote control data is stored in the control data storage means. Determining whether or not the packet meets the passage condition based on the control data being determined whether or not the packet includes a control command from the terminal; Includes a firewall unit that controls to transfer the packet to the control unit when the packet includes a control command, and performs a data update process based on the remote control data in accordance with the control command. There is provided a firewall apparatus comprising control means for controlling the result to be notified to at least one of the network and the terminal.

  According to a sixth aspect of the present invention, there is provided the firewall apparatus according to any one of the first to fifth aspects, wherein the remote control data further includes at least one of control data, software, and a control command. Is done.

  According to a seventh aspect of the present invention, there is provided a communication system in which a firewall device and a control center are connected via a network, wherein the control center stores a control data database storing control data of the firewall device, and the control Center communication means for transmitting remote control data including data, and the firewall device communicates with at least the control center via a network, and remote control data storage means for storing at least remote control data Control data storage means for storing at least control data, and analyzing the packet received by the communication means, determining whether the packet includes remote control data from the control center, If the remote control data is included, the remote control data is transferred to the remote control data. If it is stored in the control data storage means and the remote control data is not included, it is determined whether or not the packet meets the passage condition based on the control data stored in the control data storage means. There is provided a communication system characterized in that control is performed.

  According to an eighth aspect of the present invention, there is provided a communication system comprising a control center, a firewall device connected to the control center via a network, and a terminal capable of communicating with the control center via the firewall device, The control center has a control data database for storing control data of the firewall device, a terminal database for storing data of the terminal, and a center communication means for transmitting remote control data including the control data, The firewall apparatus includes: a first communication unit that communicates with at least a control center via a network; a second communication unit that communicates with a terminal; a remote control data storage unit that stores at least remote control data; Control data storage means for storing control data, and the first communication unit Alternatively, the packet received by the second communication means is analyzed to determine whether or not the remote control data from the control center is included in the packet, and if the remote control data is included, the remote If the control data is stored in the remote control data storage means and the remote control data is not included, the packet matches the passage condition based on the control data stored in the control data storage means. It is determined whether or not the packet includes a control command from the terminal, and if the packet includes a control command from the terminal or the control center, the control means Firewall means for controlling the transfer, and updating or reading of the firewall means settings or remote control data according to the control command. Ku and update process, the result of the updating process and a control means for controlling to notify at least one of the network and the terminal, there is provided a communication system, characterized in that.

  According to a ninth aspect of the present invention, there is provided a communication method using a communication system comprising a control center, a firewall device connected to the control center via a network, and a terminal capable of communicating with the control center via the firewall device. In the firewall device, when the firewall means analyzes the received packet, determines whether or not the packet includes remote control data from the control center, and includes the remote control data. The remote control data is stored in the remote control data storage means, and if the remote control data is not included, the packet matches the passage condition based on the control data stored in the control data storage means. Whether or not the packet includes a control command from the terminal. Further, if the packet includes a control command from the terminal or the control center, control is performed so that the packet is transferred to the control unit. The control unit sets the firewall unit according to the control command. There is provided a communication method characterized in that an update process based on update or reading or remote control data is performed, and control is performed so as to notify the result of the update process to at least one of the network and the terminal.

  According to the present invention, by configuring the firewall device with hardware, it is possible to perform basic operations such as filtering independently without depending on the OS and without depending on the state of the terminal. To provide a firewall device, a communication system using the same, and a communication method that can execute control data rewrite independently without a control by a terminal by clearly separating a firewall function and a remote control function Can do.

  Embodiments of the present invention will be described below with reference to the drawings.

(First embodiment)
FIG. 1 shows a configuration example of a firewall apparatus according to the first embodiment of the present invention and a communication system using the firewall apparatus, and will be described.

  As shown in FIG. 1, the remote control center 3 that centrally manages the firewall devices 1a, 1b,... Has a terminal database (DB) 4 and a control data DB 5. The terminals 2a, 2b,... Can communicate with each other or with the remote control center 3 via the firewall devices 1a, 1b,. In the following description, reference numeral 1 is used to collectively refer to the firewall devices 1a, 1b,..., And reference numeral 2 is used to collectively refer to the terminals 2a, 2b.

  Here, the detailed configuration of the firewall device 1 is as shown in FIG.

  As shown in FIG. 2, the firewall device 1 includes a network interface (I / F) unit 11, a firewall core unit 12, a remote control data storage unit 13, a control unit 14, a control data storage unit 15, and log data storage. Unit 16 and terminal I / F unit 17.

  The network I / F unit 11 is an I / F for communication via the network 6 such as a LAN or a WAN. For example, when a packet is transmitted from the remote control center 3 via the network 6, the packet is transmitted to the firewall core unit 12 via the network I / F unit 11. The firewall core unit 12 controls data traffic based on the control data stored in the control data storage unit 15. In other words, the firewall core unit 12 has a so-called packet filtering function that can restrict passing packets and discard illegal packets that are not allowed to pass. In this case, the firewall core unit 12 compares the packet with control data (passing conditions) stored in the control data storage unit 15 and determines whether or not the packet can pass. Details of this will be described later.

  The remote control data storage unit 13 is for storing remote control data transmitted from the remote control center 3 via the network 6. The remote control data storage unit 13 can only write remote control data transmitted from the remote control center 3 or the like via the network 6, and the remote control data can be read only by the control unit 14. It is possible. That is, the firewall core unit 12 can store the remote control data in the remote control data storage unit 13, but cannot read the remote control data from the remote control data storage unit 13. Here, the remote control data is included in the data portion of a packet sent from the remote control center 3 via the network 6, and includes control data, software such as firmware, control commands, and the like.

  The control unit 14 controls the firewall device 1 in accordance with a control command included in a packet from the terminal 2 or the remote control center 3. More specifically, it controls the setting of the operation mode of the firewall apparatus 1, the update of control data, the update of software such as firmware, and the operation related to log data. The control data storage unit 15 is for storing control data for operating the firewall core unit 12. The log data storage unit 16 is for recording an operation history of the firewall device 1. The terminal I / F unit 17 is an I / F for communication between the firewall device 1 and the terminal 2.

  The firewall core unit 12 can be implemented as a program.

  The control unit 14 can also be implemented as a program.

  The communication means and the first communication means described in the claims correspond to the network I / F unit 11 and the like, and the second communication means corresponds to the terminal I / F unit 17 and the like, and store remote control data. The means corresponds to the remote control data storage unit 13 or the like, the firewall means corresponds to the firewall core unit 12 or the like, the control data storage means corresponds to the control data storage unit 15 or the like, and the control means refers to the control unit. It corresponds to 14 mag. However, it is not limited to these relationships.

  In the above configuration, the firewall device 1 according to the first embodiment is software-based in that the basic operation can be performed independently regardless of the state of the terminal 2 that has jurisdiction (activation / non-activation). It is different from the configured personal firewall. For example, in the personal firewall according to the prior art, even if the traffic is in a dangerous state, the traffic cannot be blocked unless the terminal 2 is activated. The firewall device according to the first embodiment 1 can block regardless of the state of the terminal 2.

  In addition, since the firewall function 1 and the remote control function are clearly separated in the firewall device 1, the firewall function can be executed independently without control from the terminal 2, and control data is stored. Rewriting of control data (including control parameters) of the unit 15 can also be performed independently without control by the terminal 2. Further, the remote control center 3 can be controlled remotely only by updating the control data (including control parameters), thereby ensuring security.

  Next, FIG. 3A shows an example of a packet transmitted from the remote control center 3, and FIG. 3B shows an example of a table relating to a passage condition included in the control data.

  First, as shown in FIG. 3A, a packet includes a header portion and a data portion, and the header portion includes an IP header and a TCP / UDP header.

  In the IP header of this packet, for example, a version number (Ver.No.), a protocol type (Protocol Type; hereinafter abbreviated as PT), a source IP address (Src.ADDR; hereinafter abbreviated as SA), a destination An IP address (Dst.ADDR; hereinafter abbreviated as DA) and the like are included. Further, the TCP / UDP header includes a source / destination port number (Port No .; hereinafter abbreviated as PN) and the like.

  On the other hand, the data portion of the packet includes payload data, specific information (hereinafter abbreviated as SD), and the like. This SD is for determining whether or not there is a computer virus or the like. Further, remote control data (including control data, firmware, control commands, etc.) is included in this data portion.

  Then, as shown in FIG. 3B, the table relating to the packet filtering passage conditions includes the IP, PT, SA, DA, DN, SP, and flags (“1” in the case of passage) included in the packet described above. In the case of non-passing, “0” or the like) is associated, and conditions for determining whether or not to pass are defined. The firewall core unit 12 reads the information of the IP, PT, SA, DA, DN, and SP of the packet received via the network I / F unit 11, and is determined in advance in the table of FIG. The handling of the packet is determined in light of the existing conditions (packet filtering).

  Here, in the firewall device 1 of the present embodiment, the log data is stored in the log data storage unit 16 by appropriately grasping the usage situation that changes every day and appropriately depending on the usage situation. This is because it is important to take appropriate measures, and monitoring and management of logs is important in order to cope with these situations.

  Hereinafter, referring to the flowchart of FIG. 4, the firewall core when the firewall apparatus 1 according to the first embodiment of the present invention receives external packet input from the network 6 via the network I / F unit 11. The flow of processing by the unit 12 will be described in detail.

  This process corresponds to the communication method according to the first embodiment.

  When receiving the packet via the network I / F unit 11, the firewall core unit 12 analyzes the packet and determines whether or not remote control data is included (step S1). If remote control data is included, the remote control data is stored in the remote control data storage unit 13 (step S2), and the process is terminated.

  On the other hand, when the remote control data is not included in the packet, the firewall core unit 12 collates with the control data stored in the control data storage unit 15 (step S3). The control data includes log conditions and passage conditions. Then, the firewall core unit 12 determines whether or not the log data of the packet matches the log condition (step S4), and if the log data matches the log condition, the log data is stored in the log data storage unit 16. Writing (step S5), the process proceeds to step S6. If the log conditions are not met, it is determined whether or not the log conditions should be passed (step S6).

  In this step S6, the firewall core unit 12 should not allow the packet to pass with reference to the table (FIG. 3B) relating to the passing condition included in the control data stored in the control data storage unit 15. If it is determined that the packet is discarded, the packet is discarded (step S7), and the process ends. On the other hand, if it is determined that the packet should be passed, the packet is transmitted to the terminal I / F unit 17 (step S8), and the process is terminated.

  Next, referring to the flowchart of FIG. 5, the firewall apparatus 1 according to the first embodiment of the present invention receives a packet external input from the terminal 2 via the terminal I / F unit 17. A process flow by the core unit 12 will be described in detail.

  This process corresponds to the communication method according to the first embodiment.

  When receiving the packet via the terminal I / F unit 17, the firewall core unit 12 analyzes the packet and determines whether or not a control command is included (step S11). If it is determined in step S11 that a control command is included, the firewall core unit 12 sends the control command to the control unit 14 (step S12), and the process ends. On the other hand, when determining that the control instruction is not included in the packet, the firewall core unit 12 collates with the control data stored in the control data storage unit 15 (step S13). The control data includes log conditions and passage conditions.

  The firewall core unit 12 determines whether or not the log data of the packet matches the log condition (step S14). If the log data matches the log condition, the log data is stored in the log data storage unit 16. Writing (step S15), the process proceeds to step S16. On the other hand, when the log condition is not met, the firewall core unit 12 refers to the table relating to the passage condition included in the control data stored in the control data storage unit 15 and transmits the packet. It is determined whether or not to pass (step S16).

  In step S16, if the firewall core unit 12 determines that the packet should not be passed, the firewall core unit 12 discards the packet (step S17) and ends the process. On the other hand, if the firewall core unit 12 determines that the packet should be passed, the firewall core unit 12 transmits the packet to the network 6 via the network I / F unit 11 (step S18), and the process ends.

  Next, with reference to the flowcharts of FIG. 6 and FIG. 7, the processing by the control unit 14 of the firewall device 1 according to the first embodiment of the present invention will be described in detail.

  This process corresponds to the communication method according to the first embodiment.

  As shown in FIG. 6, the control unit 14 first determines whether or not it is a control command from the terminal 2 (step S21). Here, when it is determined that the control command is from the terminal 2, it is determined whether or not it is related to the setting update (step S22).

  If it is determined in step S22 that the setting is related to updating, the setting is updated (step S23). Specifically, the control unit 14 updates at least one of the operation mode, control data, and log settings of the firewall core unit 12.

  Thereafter, the control unit 14 determines whether or not the update is successful (step S24), and if the update is not successful, notifies the terminal 2 that the update has failed (step S25) and succeeds in the update. If so, the terminal 2 is notified of the success of the update (step S26), and this process ends.

  On the other hand, in step S22, when the control unit 14 determines that the control command is not related to setting update, the control unit 14 determines whether the control command is related to setting reading (step S27). If it is not related to setting readout in step S27, the present process is terminated, and if it is related to setting readout, the setting is read (step S28).

  More specifically, the control unit 14 reads out information related to the operation mode, control data, and log settings of the firewall core unit 12 from the control data storage unit 15.

  Then, the control unit 14 determines whether or not the information related to these settings should be transmitted to the remote control center 3 (step S29). If it is determined that the information should be transmitted, the control unit 14 permits the terminal to transmit the settings. Then, the information is transmitted to the remote control center 3 (step S30), and this process is terminated. On the other hand, if it is determined that the information should not be transmitted, the processing is terminated without transmitting the information to the remote control center 3.

  On the other hand, as shown in FIG. 7, if it is determined in step S21 in FIG. 6 that the control command is not from the terminal 2, the control unit 14 responds to the request from the remote control data storage unit 13 and The remote control data is read from the control data storage unit 13 (step S31), and the validity of the remote control data is confirmed (step S32).

  Next, the control unit 14 determines whether or not the remote control data is valid (step S33). If it is determined that the remote control data is not valid, the control unit 14 discards the data (step S34) and sends the data to the remote control center 3. Is notified (step S35), and this process is terminated.

  On the other hand, if it is determined in step S33 that the data is valid, an update application is made to the terminal 2 (step S36), it is determined whether or not the update is permitted (step S37), and the update is performed. If not permitted, the process proceeds to step S40.

  On the other hand, when the update is permitted, the control unit 14 updates the remote control data (step S38). Specifically, control data included in the remote control data, software such as firmware is updated. Then, the control unit 14 determines whether or not the update is successful (step S39), and if the update is not successful, notifies the terminal 2 and the remote control center 3 that the update has failed (step S40). If the update is successful, the terminal 2 and the remote control center 3 are notified of the update success (step S26), and the process is terminated.

  As described above, since the firewall device 1 according to the first embodiment of the present invention is configured by hardware, it does not depend on the OS and further changes to the state of the terminal (startup / non-startup). Regardless, the basic operation can be performed independently. In the firewall device 1 according to the first embodiment, the firewall function and the remote control function are clearly separated, so that the firewall function can be executed independently without control from the terminal 2. Thus, rewriting of control parameters of control data in the control data storage unit 15 can be performed independently without control by the terminal 2.

(Second Embodiment)
Next, a communication system using the firewall device according to the second embodiment of the present invention will be described in detail. Since the configuration of the communication system using this firewall device is substantially the same as that shown in FIGS. 1 and 2, the same reference numerals are used for the same components, and the characteristic of the second embodiment is described below. Detailed processing will be described in detail.

  This process also corresponds to the communication method according to the second embodiment.

  In the second embodiment of the present invention, the secure remote control is realized by installing the firewall device 1 having the configuration and operation as described above for each terminal 2.

  The firewall device 1 is centrally managed by the remote control center 3 to provide a maintenance-free service to the user. Each firewall device 1 is realized by hardware and further assigned a unique unique ID.

  With the installation of the firewall device 1, management control software corresponding to the firewall device 1 is installed in each terminal 2. The terminal 2 can make all settings (including updating and reading of settings) related to the corresponding firewall device 1 based on the management control software. The management control software also has a function of transmitting application information and user identification information of the terminal 2 to the firewall device 1.

  After the installation of such management control software is completed, the user of the terminal 2 registers and registers application information, communication light information, prohibited communication light (or type, for example, a site that provides violent content) that he / she uses. Information is transmitted to the remote control center 3.

  The remote control center 3 generates control data for the user based on the user registration information. That is, for each unique ID of the firewall device 1, control data (including the protocol to be used, unique communication light, etc.) corresponding to the URL, protocol information, application, etc. is generated and registered in the control data DB 5. Then, the generated control data is transmitted to the firewall device 1 having the unique ID, and a setting is requested. More specifically, a packet having remote control data including control data in the data part is transmitted.

  When the firewall device 1 receives this packet (including control data), the firewall device 1 requests the terminal 2 to update the control data and requests update authentication of the user of the terminal 2. When the user of the terminal 2 approves the update, the firewall device 1 updates the setting of the control data storage unit 15 based on the transmitted control data. On the other hand, when the user of the terminal 2 does not approve the update, the firewall device 1 does not update the setting. When the update is successful, the firewall device 1 notifies the update result to the remote control center 3. The same applies to the case where the firmware of the firewall device 1 is updated.

  The following is a part that is different in operation from the first embodiment described above.

  When the firewall apparatus 1 detects data traffic of an unknown type (an unknown application, an unknown protocol, etc.), it issues a confirmation request to the terminal 2. When the user of the terminal 2 receives the confirmation request and permits communication, an unknown type is added to the control data, the fact is notified to the remote control center 3, and the corresponding data item in the terminal DB 4 is updated. (to add. If communication is not permitted, this is also notified, but it is not added to the control data. If the user of the terminal 2 receives a confirmation request from the firewall device 1 and does not confirm within a certain time, the terminal 2 transmits the confirmation request to the remote control center 3.

  After receiving the confirmation request from the terminal 2, the remote control center 3 collates with information registered in the terminal DB 4 and the control data DB 5. When it is determined that the data does not match the user registration information or is dangerous data, a blocking command (control command) for the data is issued to the firewall device 1 and communication is not permitted. On the other hand, if the remote control center 3 matches the user registration information and determines that there is no danger, the remote control center 3 issues a passage command (control command) for the data to the firewall device 1 and permits communication. As described above, the remote control center 3 can control the firewall device 1 by issuing a passage command (control command) or a blocking command (control command) to the firewall device 1 in a predetermined case.

  In any case, the control data set in the firewall device 1 and the log data in the log data storage unit 16 cannot be read out without user approval.

  As described above, according to the second embodiment of the present invention, in addition to the effect of the firewall device according to the first embodiment described above, even when an unknown type of data traffic is detected, Appropriate measures can be taken by centralized management by the control center 3.

  The first and second embodiments of the present invention have been described above. However, the present invention is not limited to this, and various improvements and modifications can be made without departing from the spirit of the present invention. For example, the firewall apparatus according to the first and second embodiments can be realized by a PC card externally attached to a personal computer as a terminal. Further, when the system includes a firewall device corresponding to the external Internet or the like, efficient processing can be realized by sharing the role with the firewall device.

The figure which shows the structural example of the firewall apparatus which concerns on the 1st Embodiment of this invention, and a communication system using the same. The figure which shows the detailed structure of the firewall apparatus 1. FIG. (A) is a figure which shows an example of the packet transmitted from the control center 3, (b) is a figure which shows an example of the table which concerns on the passage conditions contained in control data. 6 is a flowchart for explaining in detail the flow of processing by the firewall core unit 12 when the firewall device 1 according to the embodiment of the present invention receives external input of a packet from the network 6 via the network I / F unit 11. The flowchart explaining in detail the flow of processing by the firewall core unit 12 when the firewall device 1 according to an embodiment of the present invention receives external input of a packet from the terminal 2 via the terminal I / F unit 17. . The flowchart explaining in detail the process by the control part 14 of the firewall apparatus 1 which concerns on one embodiment of this invention. The flowchart explaining in detail the process by the control part 14 of the firewall apparatus 1 which concerns on one embodiment of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Firewall apparatus, 2 ... Terminal, 3 ... Control center, 4 ... Terminal DB, 5 ... Control data DB, 11 ... Network I / F part, 12 ... Firewall Core units 12, 13 ... remote control data storage units 13, 14 ... control unit, 15 ... control data storage unit, 16 ... log data storage unit, 17 ... terminal I / F unit .

Claims (9)

A communication means for communicating with the outside via a network;
Remote control data storage means for storing at least remote control data;
The packet received by the communication means is analyzed to determine whether the remote control data is included in the packet. If the remote control data is included, the remote control data is converted to the remote control data. Firewall means for controlling storage in the storage means;
A firewall apparatus comprising: A communication means for communicating with the outside via a network;
Remote control data storage means for storing at least remote control data;
Control data storage means for storing at least control data;
The packet received by the communication means is analyzed to determine whether the remote control data is included in the packet. If the remote control data is included, the remote control data is converted to the remote control data. If it is stored in the storage means and the remote control data is not included, it is determined whether or not the packet matches the passage condition based on the control data stored in the control data storage means. Firewall means to control
A firewall apparatus comprising:   The firewall means controls to pass the packet when it is determined that the packet matches the passage condition, and to discard the packet when it is determined that the packet does not match the passage condition. The firewall device according to claim 2, further characterized.   Log data storage means for storing the log data of the packet; and the firewall means determines whether the packet matches a log condition included in the control data, and matches the log condition. 3. The firewall device according to claim 2, further comprising: writing log data of the packet into the log data storage means when there is a packet. A first communication means for communicating with the outside via a network;
A second communication means for communicating with the terminal;
Remote control data storage means for storing at least remote control data;
Control data storage means for storing at least control data;
If the packet received by the first communication means or the second communication means is analyzed, it is determined whether the remote control data is included in the packet, and if the remote control data is included The remote control data is stored in the remote control data storage means, and if the remote control data is not included, the packet matches the passage condition based on the control data stored in the control data storage means. It is determined whether the packet includes a control command from the terminal, and if the packet includes a control command, the packet is transferred to the control means. Firewall means to control;
In accordance with the control command, control means for performing a data update process based on remote control data, and controlling to notify the result of the update process to at least one of the network and the terminal;
A firewall apparatus comprising:   6. The firewall apparatus according to claim 1, wherein the remote control data further includes at least one of control data, software, and a control command. A communication system in which a firewall device and a control center are connected via a network,
The control center
A control data database for storing control data of the firewall device;
Center communication means for transmitting remote control data including the control data;
Have
The firewall device
A communication means for communicating with at least the control center via a network;
Remote control data storage means for storing at least remote control data;
Control data storage means for storing at least control data;
Have
The packet received by the communication means is analyzed to determine whether or not the packet includes remote control data from the control center. If the remote control data is included, the remote control data is If the packet is stored in the remote control data storage means and the remote control data is not included, whether or not the packet matches the passage condition based on the control data stored in the control data storage means A communication system, characterized in that control is performed to determine A communication system comprising a control center, a firewall device connected to the control center via a network, and a terminal capable of communicating with the control center via the firewall device,
The control center
A control data database for storing control data of the firewall device;
A terminal database for storing the data of the terminal;
Center communication means for transmitting remote control data including the control data;
Have
The firewall device
First communication means for communicating with at least the control center via a network;
A second communication means for communicating with the terminal;
Remote control data storage means for storing at least remote control data;
Control data storage means for storing at least control data;
The packet received by the first communication means or the second communication means is analyzed, it is determined whether or not the remote control data from the control center is included in the packet, and the remote control data is included. If the remote control data is not included, the remote control data is stored in the remote control data storage means. If the remote control data is not included, the packet is transmitted based on the control data stored in the control data storage means. It is determined whether or not the passage condition is satisfied, and further, it is determined whether or not the packet includes a control command from the terminal, and the packet includes a control command from the terminal or the control center. Firewall means for controlling to forward to the control means in the case,
A control means for performing control to update or read the setting of the firewall means according to the control command, or to perform update processing based on remote control data and to notify the result of the update processing to at least one of the network and the terminal; ,
Having
A communication system characterized by the above. A communication method by a communication system comprising a control center, a firewall device connected to the control center via a network, and a terminal capable of communicating with the control center via the firewall device,
In the above firewall device,
Firewall means analyzes the received packet to determine whether the packet contains remote control data from the control center. If the remote control data is included, the remote control data is If it is stored in the control data storage means and the remote control data is not included, it is determined whether or not the packet matches the passage condition based on the control data stored in the control data storage means. Further, it is determined whether or not the packet includes a control command from the terminal. If the packet includes a control command from the terminal or the control center, control is performed so that the packet is transferred to the control means. ,
The control means controls to update or read the setting of the firewall means according to the control command, or to perform update processing based on the remote control data, and to notify the result of the update processing to at least one of the network and the terminal. To
A communication method characterized by the above.

Images